Bohannan v. Innovak International, Inc.

318 F.R.D. 525, 2016 U.S. Dist. LEXIS 102496, 2016 WL 4154937

• Court: District Court, M.D. Alabama
• Decided: August 4, 2016
• Docket: CASE NO. 1:16-CV-272-WKW
• Status: Published

Opinion

MEMORANDUM OPINION AND ORDER

W. Keith Watkins, CHIEF UNITED STATES DISTRICT JUDGE

Before the court is Defendant’s motion to dismiss (Doc. # 8), which is construed as also containing a motion for a more definite statement (see Doc. # 8, at 10). The motions have been fully briefed (Docs. # 14 and 15). Upon careful consideration, both motions will be denied.

I.JURISDICTION AND VENUE

Subject-matter jurisdiction is exercised pursuant to the Class Action Fairness Act, 28 U.S.C. § 1832(d). Plaintiffs allege that they are all citizens of Alabama, that Defendant is a citizen of South Carolina, that they bring this action on behalf of a class that exceeds 100 individuals, and that the amount in controversy exceeds $5,000,000. The parties do not contest personal jurisdiction or venue.

II.STANDARD OF REVIEW

A motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure tests the sufficiency of the complaint against the legal standard articulated by Rule 8 of the Federal Rules of Civil Procedure. Rule 8 provides that the complaint must include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). When evaluating a motion to dismiss pursuant to Rule 12(b)(6), the court must take the facts alleged in the complaint as true and construe them in the light most favorable to the plaintiff. Resnick v. AvMed, Inc., 693 F.3d 1317, 1321-22 (11th Cir.2012).

To survive a Rule 12(b)(6) motion, the complaint “must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)). The complaint is facially plausible when “the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678, 129 S.Ct. 1937.

A party may move for a more definite statement under Rule 12(e) of the Federal Rules of Civil Procedure when a pleading is “so vague or ambiguous that the party cannot reasonably prepare a response.”

III.BACKGROUND

Plaintiffs brought this class action after learning that unknown individuals misappropriated their personal private information. The facts and procedural history will be briefly discussed.

Defendant Innovak International, Inc. (“Innovak”) is an information technology company serving employers like schools, school systems, and other state agencies. In-novak’s software allows its end users to access tax and payroll information remotely through its internet portal. The internet portal stores an array of employee personal private information (“PPI”), including social security numbers, addresses, telephone numbers, and dates of birth.

Plaintiffs, who are end users of Innovak’s ledger software system,¹ allege that Innovak suffered a security breach when hackers infiltrated the internet portal. They contend that Innovak was aware of its software’s vulnerabilities as early as 2014, yet failed to take protective measures to ensure data security. They further contend that, in April of 2016, Innovak admitted to news media outlets that it suffered a data breach, but took no steps to directly inform its end users of the breach. Instead, Plaintiffs learned about the breach when they received letters from the Internal Revenue Service indicating that their PPI had been compromised.

In their class action complaint, Plaintiffs assert claims for (1) negligence, (2) breach of implied contract, (3) gross negligence, recklessness and/or wantonness, (4) unjust enrichment, and (5) fraudulent suppression. Plaintiffs allege that they have suffered psychic injuries as a result of learning that their PPI had been compromised. Some Plaintiffs further allege that nefarious individuals used their misappropriated PPI to file false tax returns in their names. They also have incurred the costs of mitigating additional harm associated with the breach. They seek compensatory damages, punitive damages, restitution, attorneys’ fees, and costs.

The complaint includes specific class action allegations. Plaintiffs define the putative nationwide class as “all persons whose PPI was compromised as a direct and proximate result of the Innovak data breach.” (Doc. # 1, at 8.) They alternatively propose various statewide classes consisting of, for example, “[a]ll persons in Alabama whose PPI was compromised as a direct result of the Inno-vak data breach.” (Doc. # 1, at 8.) With respect to the class action prerequisites set forth in Rule 23(a) of the Federal Rules of Civil Procedure, Plaintiffs contend that the class is so numerous that joinder is impracticable, that there are questions of law and fact common to putative class members, that Plaintiffs’ claims are typical of the claims of the class members, and that Plaintiffs will adequately protect the interests of the putative class members. They further allege that the questions of law and fact common to the class members predominate over individual questions, and that class treatment is superi- or to individual adjudication. See Fed. R. Civ. P. 23(b)(3).

Innovak responded to Plaintiffs’ complaint with a motion to dismiss for failure to state a claim upon which relief can be granted. (Doc. #8.) Pursuant to the briefing order (Doc. # 12), Defendants filed a brief in support of their motion (Doc. # 14), and Plaintiffs filed a response (Doc. # 15). Defendants did not file a reply brief, and the matter is considered submitted on the briefing.

IV. DISCUSSION

In the motion now before the court, Inno-vak advances three arguments. First, it contends that Plaintiffs’ class complaint should be dismissed for failure to satisfy Rule 23 of the Federal Rules of Civil Procedure. Second, it argues that the complaint should be dismissed for failure to state a claim upon which relief can be granted. Third, it maintains that the complaint is so vague or ambiguous that it cannot reasonably prepare a response. These arguments will be addressed in turn.

A. The Complaint Will Not Be Dismissed for Failure to Satisfy Rule 23.

Innovak first argues that the class complaint should be dismissed because the class is not ascertainable, and thus fails to satisfy the requirements of Rule 23. The principles governing class certification will first be generally addressed. These principles will then be applied to Plaintiffs’ proposed class.

Pursuant to Rule 23(a), plaintiffs may sue on behalf of a class only where: “(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law and fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class.” Rule 23(b) further requires that the class fit within one of three enumerated categories, In addition to these explicit requirements, Rule 23 has been construed to include an implicit requirement that the purported class be ascertainable by reference to objective criteria. Bussey v. Macon Cty. Greyhound Park, 562 Fed.Appx. 782, 787 (11th Cir.2014). The objective criteria should allow class members to be identified in a manner that is administratively feasible, which means that identifying class members requires little, if any, individual inquiry. Id.

Where the proposed class definition requires the court to determine the merits of an individual class member’s claims as a predicate to determining her membership in the class, the class is not ascertainable. See Likes v. DHL Express, 288 F.R.D. 524, 531-32 (N.D.Ala.2012). These “fail-safe” classes, which are framed in terms of legal conclusions, are not administratively feasible. They inevitably require mini-trials to determine which individuals belong to the class. William H. Rubenstein, Newberg on Class Actions § 3:6 (5th ed.).

Innovak contends that Plaintiffs’ proposed class constitutes a fail-safe class and is otherwise unascertainable under the controlling legal principles. Innovak acknowledges that class allegations generally are not dismissed at the pleading stage for failure to comply with Rule 23, but nonetheless maintains that it is appropriate to dismiss Plaintiffs’ class complaint under Rule 12(b)(6). (Doc. # 14, at 5 (citing Schilling v. Kenton Cty., Civil Action No. 10-143-DLB, 2011 WL 293759 (E.D.Ky. Jan. 27, 2011).) Despite the early nature of this motion, nothing in Rule 23 precludes the consideration of class certification issues in the context of a motion to dismiss. It merely provides that issues of class certification should be decided “at an early practicable time.” Fed. R. Civ. P. 23(c)(1)(A).

The relevant inquiry here is whether the allegations are sufficient to plausibly support the existence of an ascertainable class. See Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. Or, to borrow phrasing from the case on which Innovak chiefly relies for this motion, the moving party bears the burden of demonstrating that it will be “impossible to certify the class as alleged.” Schilling, 2011 WL 293759, at * 4 (citing Bryant v. Food Lion, Inc., 774 F.Supp. 1484, 1495 (D.S.C.1991)). The issue of whether Plaintiffs proposed a fail-safe class will be addressed first. It will then be determined whether the proposed class is otherwise ascertainable.

Based on the allegations in the complaint, it cannot be said that Plaintiffs have proposed an unascertainable fail-safe class. As noted above, a proposed class is deficient as fail-safe where it is defined in such a way that determining its membership requires a determination of the merits of the potential class members’ claims. See Likes, 288 F.R.D. at 531-32. Innovak argues that Plaintiffs’ proposed class definitions require findings “that [Innovak’s] conduct was ‘wrongful,’ ‘unlawful,’ ‘negligent,’ ‘wanton,’ [or] ‘reckless.’” (Doc. # 14, at 6.) Innovak also contends that the class definitions require the finding “that [Innovak] ‘knew of the risks,’ acted with a ‘conscious disregard,’ and ‘refused to take adequate and reasonable precautions ... to adequately protect [PPI].’ ” (Doc. # 14, at 6-7.)

None of the words or phrases Innovak quoted in this portion of its brief actually appears in the proposed class definitions. The proposed class definitions themselves do not mention that Innovak was negligent, reckless, or wanton in its behavior. Nor do the proposed class definitions make reference to Innovak’s conscious disregard for a known risk. The proposed classes merely include those persons, either on a nationwide or statewide scale, “whose PPI was compromised as a direct and proximate result of the Innovak data breach.” (Doe. # 1, at 8.) Inno-vak grafted this litany of legal conclusions onto the proposed class definitions without further explanation. They otherwise are only found in the portion of the complaint in which Plaintiffs lay out their causes of action.

The only aspect of the proposed class definitions that could arguably call for a legal conclusion is the requirement that class members’ PPI be compromised as a “direct and proximate result” of the Innovak data breach. Whether some event proximately caused the harm of which a plaintiff complains is a question that requires a legal conclusion. But the definitions offered in Plaintiffs’ complaint do not venture so far as to inquire whether, as a matter of law, the Innovak data breach proximately caused the ultimate harm the putative class member suffered. Instead, they ask whether the Inno-vak data breach caused the putative class member’s PPI to be compromised, which is a question that can be answered without engaging in a final adjudication of the merits of the putative class member’s claim for liability against Innovak. The definitions merely require the finding that the putative class member’s data was rendered insecure as a result of the data breach. And Plaintiffs allege that Innovak’s own records will confirm which end users were affected by the breach.

The class, as alleged, is otherwise sufficiently ascertainable to survive Rule 12(b)(6) scrutiny. Plaintiffs contend that Innovak maintains PPI in a centralized location, that its records will indicate which PPI was compromised as a result of the breach, that there is a finite number of end users whose data could have been compromised, and that all end users were affected by the breach. Taking these allegations as true, the complaint is sufficient to indicate that class members can be ascertained by administratively feasible objective criteria. See Karhu v. Vital Pharm., Inc., 621 Fed.Appx. 945, 948 (11th Cir.2015) (holding that the class is ascertainable where the proponent of class certification can establish that the class members can be identified by reference to records that are in the defendant’s control and are useful for identification purposes). The discovery process will ultimately reveal whether Innovak’s records provide a feasible means of identifying all end users whose PPI was compromised. And the parties can move for a final decision on the issue of class certification after this period for investigation.

For purposes of the instant motion to dismiss, however, it cannot be said that the alleged class is impossible to certify. Accordingly, to the extent Innovak seeks to dismiss the complaint for failure to comply with Rule 23, its motion is due to be denied.

B. The Complaint Will Not Be Dismissed for Failure to State a Claim.

Innovak also argues generally that the complaint should be dismissed for failure to state a claim. See Fed. R. Civ. P. 12(b)(6). Innovak’s only argument on this point is that Plaintiffs’ complaint does not specify what measures or steps Innovak should have taken to prevent the data security breach. (Doc. # 14, at 12.) The complaint contains sufficient factual matter, however, to support a plausible claim for relief. See Iqbal, 556 U.S. at 678, 129 S.Ct. 1937.

Plaintiffs allege that Innovak was aware of the vulnerabilities in its data storage system and that it failed to take reasonable steps to prevent a breach. They further allege that Innovak chose not to “lockdown its internet portal” or notify its end users that them PPI had been compromised. (Doc. # 1, at 11.) In its motion, Innovak offers no authority supporting the proposition that Plaintiffs must specifically allege which protective action In-novak should have taken to prevent the breach. Taken together, the allegations in the complaint constitute a plain statement showing that Plaintiffs are entitled to relief. See Fed. R. Civ. P. 8(a)(2). Applying the Rule 12(b)(6) standard, the factual allegations support the plausible inference that Innovak is liable for the claims asserted. See Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. Accordingly, to the extent Innovak seeks to dismiss the complaint pursuant to Rule 12(b)(6), its motion is due to be denied.

C. Plaintiffs Will Not Be Ordered to Provide A More Definite Statement.

Innovak finally argues that Plaintiffs should be ordered to provide a more definite statement pursuant to Rule 12. It cannot be said, however, that the allegations are so vague or ambiguous that Innovak cannot prepare a response. See Fed. R. Civ. P. 12(e). The factual allegations are neither vague nor ambiguous. Plaintiffs specifically identify the grounds for their relief such that Innovak is in a position to prepare its answer. Innovak’s motion for a more definite statement is thus due to be denied.

V. CONCLUSION

Accordingly, it is ORDERED that Defendant’s motion to dismiss (Doe. #8) is DENIED. It is further ORDERED that Defendant’s motion for a more definite statement (Doc. # 8) is DENIED.

Attachment

A copy of this checklist is available at the website for the USCA, 11th Circuit at www. call.uscourts.gov Effective on December 1, 2013, the new fee to file an appeal will increase from $455.00 to $505.00.

CIVIL APPEALS JURISDICTION CHECKLIST

1. Appealable Orders: Courts of Appeals have jurisdiction conferred and strictly limited by statute:

(a) Appeals from final orders pursuant to 28 U.S.C. § 1291: Only final orders and judgments of district courts, or final orders of bankruptcy courts which have been appealed to and fully resolved by a district court under 28 U.S.C. § 158, generally are appealable. A final decision is one that “ends the litigation on the merits and leaves nothing for the court to do but execute the judgment.” Pitney Bowes, Inc. v. Mestre, 701 F.2d 1365, 1368 (11th Cir. 1983). A magistrate judge’s report and recommendation is not final and ap-pealable until judgment thereon is entered by a district court judge. 28 U.S.C. § 636(e).

(b) In cases involving multiple parties or multiple claims, a judgment as to fewer than all parties or all claims is not a final, appealable decision unless the district court has certified the judgment for immediate review under Fed.R.Civ.P. 54(b). Williams v. Bishop, 732 F.2d 885, 885-86 (11th Cir.1984). A judgment which resolves all issues except matters, such as attorneys’ fees and costs, that are collateral to the merits, is immediately appealable. Budinich v. Becton Dickinson & Co., 486 U.S. 196, 201, 108 S.Ct. 1717, 1721-22, 100 L.Ed.2d 178 (1988); LaChance v. Duffy’s Draft House, Inc., 146 F.3d 832, 837 (11th Cir.1998).

(c) Appeals pursuant to 28 U.S.C. § 1292(a): Appeals are permitted from orders “granting, continuing, modifying, refusing or dissolving injunctions or refusing to dissolve or modify injunctions ...” and from “[ijnterlocutory decrees ... determining the rights and liabilities of parties to admiralty cases in which appeals from final decrees are allowed.” Interlocutory appeals from orders denying temporary restraining orders are not permitted.

(d) Appeals pursuant to 28 U.S.C. § 1292(b) and Fed.R.App.P. 5: The certification specified in 28 U.S.C. § 1292(b) must be obtained before a petition for permission to appeal is filed in the Court of Appeals. The district court’s denial of a motion for certification is not itself appealable,

(e)Appeals pursuant to judicially created exceptions to the finality rule: Limited exceptions are discussed in cases including, but not limited to: Cohen v. Beneficial Indus. Loan Corp., 337 U.S. 541, 546, 69 S.Ct. 1221, 1225-26, 93 L.Ed. 1528 (1949); Atlantic Fed. Sav. & Loan Ass’n v. Blythe Eastman Paine Webber, Inc., 890 F.2d 371, 376 (11th Cir.1989); Gillespie v. United States Steel Corp., 379 U.S. 148, 157, 85 S.Ct. 308, 312, 13 L.Ed.2d 199 (1964).

Rev.: 4/04

2. Time for Filing: The timely filing of a notice of appeal is mandatory and jurisdictional. Rinaldo v. Corbett, 256 F.3d 1276, 1278 (11th Cir.2001). In civil cases, Fed. R.App.P. 4(a) and (c) set the following time limits:

(a) Fed.R.App.P. 4(a)(1): A notice of appeal in compliance with the requirements set forth in Fed.R.App.P. 3 must be filed in the district court within 30 days after the entry of the order or judgment appealed from. However, if the United States or an officer or agency thereof is a party, the notice of appeal must be filed in the district court within 60 days after such entry. THE NOTICE MUST BE RECEIVED AND FILED IN THE DISTRICT COURT NO LATER THAN THE LAST DAY OF THE APPEAL PERIOD—no additional days are provided for mailing. Special filing provisions for inmates are discussed below.

(b) Fed.R.App.P. 4(a)(3): “If one party timely files a notice of appeal, any other party may file a notice of appeal within 14 days after the date when the first notice was filed, or within the time otherwise prescribed by this Rule 4(a), whichever period ends later.”

(c) Fed.R.App.P. 4(a)(4): If any party makes a timely motion in the district court under the Federal Rules of Civil Procedure of a type specified in this rule, the time for appeal for all parties runs from the date of entry of the order disposing of the last such timely filed motion.

(d) Fed.R.App.P. 4(a)(5) and 4(a)(6): Under certain limited circumstances, the district court may extend the time to file a notice of appeal. Under Rule 4(a)(5), the time may be extended if a motion for an extension is filed within 30 days after expiration of the time otherwise provided to file a notice of appeal, upon a showing of excusable neglect or good cause. Under Rule 4(a)(6), the time may be extended if the district court finds upon motion that a party did not timely receive notice of the entry of the judgment or order, and that no party would be prejudiced by an extension.

(e) Fed.R.App.P. 4(c): If an inmate confined to an institution files a notice of appeal in either a civil case or a criminal case, the notice of appeal is timely if it is deposited in the institution’s internal mail system on or before the last day for filing. Timely filing may be shown by a declaration in compliance with 28 U.S.C. § 1746 or a notarized statement, either of which must set forth the date of deposit and state that first-class postage has been prepaid.

3. Format of the notice of appeal: Form 1, Appendix of Forms to the Federal Rules of Appellate Procedure, is a suitable format. See also Fed.R.App.P. 3(c). A pro se notice of appeal must be signed by the appellant.

4. Effect of a notice of appeal: A district court loses jurisdiction (authority) to act after the filing of a timely notice of appeal, except for actions in aid of appellate jurisdiction or to rule on a timely motion of the type specified in Fed.R.App.P. 4(a)(4).

1 . Ten plaintiffs brought this action on behalf of themselves and a class of similarly situated individuals. The named plaintiffs, referred to collectively as "Plaintiffs," include Melissa Bohannan, Cherissa Hall, Jolie Hall, Summer Lisenby, Maryellen Prophet, Jennifer Matheny, Tiffany McCoy, Ashley McGhee, Sherrie Salem, and Crystal Shelley.